CWE-454 · Misconfiguration and Insecure Design
External Initialization of Trusted Variables or Data Stores
4CVEs
SortMost likely exploited
4 CVEs with CWE-454 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2026-54003Kirby: External Initialization of the Panel on reverse proxy setups with the `Forwarded` headergetkirby · kirby · CVSS 9.1 · 2026-07-09 | 9.1 | 0.7% | 2026-07-09 |
| CVE-2026-26148Microsoft Azure AD SSH Login extension for Linux Elevation of Privilege VulnerabilityMicrosoft · Microsoft Azure AD SSH Login extension for Linux · CVSS 8.1 · 2026-03-10 | 8.1 | 0.4% | 2026-03-10 |
| CVE-2026-48980pam_usb: getenv() used in PAM context allows environment variable injection into local-check logicmcdope · pam_usb · CVSS 6.3 · 2026-06-18 | 6.3 | 0.2% | 2026-06-18 |
| CVE-2025-36244IBM AIX privilege escalationIBM · AIX · CVSS 7.4 · 2025-09-16 | 7.4 | 0.1% | 2025-09-16 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.